This invention relates to a job management system capable of minimizing a data amount of event logs created by a target device.
In a computer system which includes a user computer and a server computer connected to each other via a network so as to be capable of communicating with each other, it is demanded that logs created by the user computer be collected to thereby keep track of the history of various activities of the user computer based on the logs thus collected. In particular, there is an increasing need for learning a job status of a user in view of, for example, increasing job efficiency, enhancing compliance, and the implementation of Japanese Sarbanes-Oxley Act (J-SOX act) in the background. Above all, it is in high needs to monitor a job status on a user side which is represented by operations on a computer executed by the user.
In order to learn the job status on the user side, the server computer needs to collect and analyze event logs of a client computer used by the user, or event logs, which characterize user activities, obtained by a device such as a sensor. Each one of the events recorded as the event logs on the user side holds no meaning until a plurality of the events are compiled so as to be interpreted as a meaningful job. Under the circumstances, a log amount for monitoring a job status on the user side tends to be increased to an enormous amount, and therefore there is a demand for a technique capable of reducing the log amount to an appropriate amount.
There has been known a technique disclosed in JP 2002-163129 A as the technique of reducing the log amount to an appropriate amount. Specifically, a log level defining method is disclosed, in which an application program AP defines, by an initialization processing unit, the log level that can be used by the application program as a whole, delivers, to a log level input unit of a processing unit A, the value of the log level selected by the user for use in the processing unit A, as an input, and acquires the logs on the specified level during process for achieving the primary purpose of the application program on another processing unit of the processing unit A The log information thus acquired is output to an external storage device or an input/output device by a log output processing unit.
JP 2002-163129 A discloses a technique of reducing the log amount to an appropriate amount, with respect to the event logs relating to the operating status of the application program. According to this technique, upon start-up of the application program, the processing unit A reads the log level specified by an administrator, and outputs, from then on, only a log conforming to the specified log level, to the external storage device.
When the technique disclosed in JP 2002-163129 A is applied for learning the job status on the user side, the administrator needs to specify information corresponding to the log level, in other words, information specifying the events to be output and the events not to be output. As described above, however, in learning a job status on the user side, each one of the events holds no meaning until a plurality of the events are compiled so as to be interpreted as one piece of meaningful job performance information. Accordingly, the administrator needs to create specifying information for setting ON/OFF to the event output as described above so as to minimize the log amount, based on the kind of job performance information the administrator needs to obtain. However, in order to perform this work in consideration of correspondence between several hundred kinds of jobs and several hundred kinds of job performance information, a large amount of labor is imposed on the administrator.
This invention has been made in view of the above-mentioned problems, and therefore, it is an object of the invention to provide a job management system for deciding categories for log data and a combination thereof, which at least include information needed by an administrator side while keeping a data amount of the log data minimum.